ccd800bd7ab9cd58f193b257ad870ba376ff1cace4995d61a509cce01af504d9 | Triage

Sharing

General

Target

a11f80c32b5f070fa05478ea30e1d0c0_JaffaCakes118
Size

802KB
Sample

240817-ekmqksyhlj
MD5

a11f80c32b5f070fa05478ea30e1d0c0
SHA1

6b54ac293e11d801b19076a68c17094fde68e9e1
SHA256

ccd800bd7ab9cd58f193b257ad870ba376ff1cace4995d61a509cce01af504d9
SHA512

5ff2e2e24abaf2ce6127711f3233183e138b62d23727a1c791e538d4cc5665c0bd1a9bf79baae26ebc2fb582a971883515abd0fdd4ad235da2b0ea30f3878171
SSDEEP

24576:UFDqC70/xiU3jXP2KOZwsCdzslaGQjlkcw:URTo/x/jXP2KOZidzslafe

Score

9^/10

discovery evasion

Malware Config

Targets

- Target
  
  a11f80c32b5f070fa05478ea30e1d0c0_JaffaCakes118
- Size
  
  802KB
- MD5
  
  a11f80c32b5f070fa05478ea30e1d0c0
- SHA1
  
  6b54ac293e11d801b19076a68c17094fde68e9e1
- SHA256
  
  ccd800bd7ab9cd58f193b257ad870ba376ff1cace4995d61a509cce01af504d9
- SHA512
  
  5ff2e2e24abaf2ce6127711f3233183e138b62d23727a1c791e538d4cc5665c0bd1a9bf79baae26ebc2fb582a971883515abd0fdd4ad235da2b0ea30f3878171
- SSDEEP
  
  24576:UFDqC70/xiU3jXP2KOZwsCdzslaGQjlkcw:URTo/x/jXP2KOZidzslafe
Score

9^/10

discovery evasion
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  evasion
- Enumerates VirtualBox registry keys
  evasion
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

Software Discovery

System Location Discovery

System Language Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasion

behavioral2